Cable Haunt – Critical Vulnerability Let Hackers Control Cable Modems Remotely

Researchers discovered as critical vulnerability dubbed Cable Haunt affects cable modems from different manufacturers across the globe.

The vulnerability enables a remote attacker to gain complete control over the modem through its endpoint.

Successful exploitation allows attackers to intercept private messages, redirect traffic, or participate in botnets.

Cable Haunt vulnerability was discovered by a team of Danish security researchers in Broadcom cable modems.

Cable Haunt Attacks Middleware

The vulnerability targets the middleware running on the chip used in the Broadcom cable modems, the middleware is the real-time operating system in cable modems that runs all the networking tasks.

It affects multiple vendors as the same software being used by various cable modem manufacturers to create their cable modem firmware.

All the traffic goes through the cable modem middleware (CM), by gaining control over it attackers can manipulate any traffic going through the modem.

How the Attack Works

The attack is a two-step process: An attacker should gain access to the vulnerable endpoints through local networks such as browsers, this can be done by making the victim opening a malicious link in a browser.

The exploit not only the browser, but it can also be executed in any place where running the code can reach IP on the local network.

Next, the attacker needs to hit the vulnerable endpoint with buffer overflow attack, by creating a crafted message a remote attacker can manipulate the modem to execute arbitrary code specified by a remote attacker.

Once the code executed attackers can gain complete control over the modem and can perform various operation such as

• Change default DNS server
• Conduct remote man-in-the-middle attacks
• Hot-swap code or even the entire firmware
• Upload, flash, and upgrade firmware silently
• Disable ISP firmware upgrade
• Change every config file and settings
• Get and Set SNMP OID values
• Change all associated MAC Addresses
• Change serial numbers
• Be exploited in botnet

Modems Affected

Researchers estimated that “more than 200 million modems may be or might have been vulnerable in Europe alone and there is no way to track the vulnerability spread”.

Here is the list of vulnerable modems:

Model	Firmware Version	Port	Default Credentials
Sagemcom F@st 3890	50.10.19.*	6080	spectrum:spectrum (Authorization: Basic)
Sagemcom F@st 3686	SIP_3.428.0-*	6080	spectrum:spectrum (Authorization: Basic)
Technicolor TC7230	STEB 01.25	8080	No authorization needed
Netgear C6250EMR	V2.01.05	8080	No authorization needed
Netgear CG3700EMR	V2.01.03	8080	No authorization needed
Sagemcom F@st 3890	05.76.6.3a	unknown	unknown
Sagemcom F@st 3686	4.83.0	unknown	unknown
COMPAL 7284E	5.510.5.11	unknown	unknown
COMPAL 7486E	5.510.5.11	unknown	unknown
Netgear CG3700EMR	V2.01.05	8080	No authorization needed

As the cable Haunt allows attackers to gain complete access to the modem it is hard to detect the infection as the attacker can hide the tracks.

Researchers also stated that there is no evidence of active exploitation, and this attack doesn’t break SSL/TLS encryption.

A tool has been released to check whether your modem is vulnerable, the tool can be downloaded from here.

Here you find the detailed Technical report explaining the Cable Haunt vulnerability and the PoC of the attack.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates